Is Your Website Ready for India’s DPDP Rules? I Built a Free Scanner (My Blog Scored 29/100)

I built a free scanner that checks whether a website is ready for India’s new data protection rules. The first site I ran it on was this blog. It scored 29 out of 100.

That number is the reason for this post. India’s Digital Personal Data Protection (DPDP) Rules apply to most businesses from 13 May 2027, and most Indian websites I’ve looked at, including mine, aren’t ready. The good news is that the visible parts are fixable in an afternoon, once you know what to fix.

If you just want the answer for your own site, the scanner is free and needs no sign-up: dpdp-check.automationvault.net. It takes about 20 seconds.

What the DPDP Rules are, in one minute

The Digital Personal Data Protection Act, 2023 is India’s main privacy law. It sets rules for any business that handles personal data of people in India: names, phone numbers, emails, and also the device identifiers that analytics and ad tools collect. The DPDP Rules, 2025 fill in the details, and they come into force in stages.

The penalties are not small. Failing to take reasonable security safeguards can cost up to ₹250 crore, imposed by the Data Protection Board after an inquiry.

What DPDP means for a website

Most of DPDP is about what happens inside your business. But a surprising amount of it shows up on your public website, which means anyone, including a regulator or an annoyed customer, can see whether you’ve done it:

• No tracking before consent. Google Analytics, Meta Pixel, Hotjar and similar tools collect personal data. Section 6 says consent must come first, through a clear affirmative action.
• A real consent choice. Refusing and withdrawing consent must be as easy as accepting it (Section 6(4)). A banner with only an “OK” button doesn’t do that.
• A proper privacy notice. Rule 3 says it must list the personal data you collect, the purpose for each, and explain how to withdraw consent, exercise rights and complain to the Data Protection Board. Users must be able to read it in English or any language in the Eighth Schedule (Section 5(3)).
• A contact for privacy questions. Rule 9 asks you to publish the contact of a Data Protection Officer or a person who can answer questions.
• A rights and grievance process. People can ask to access, correct or erase their data, and nominate someone to act for them. Grievances must be resolved within 90 days (Rule 14).
• A notice wherever you collect data. Contact forms, sign-ups and checkouts should say what you collect and why, right where people type it in.
• HTTPS. Encryption is one of the security safeguards Rule 6 lists.

I scanned my own blog first

It felt only fair. Here’s what the scanner found on automationvault.net:

• Google Analytics and Google Ads load before anyone agrees to them. There’s no consent banner at all. That’s the biggest problem, and the most common one I’ve seen.
• The privacy policy is a generic template. It doesn’t mention DPDP, doesn’t explain how to withdraw consent, and says nothing about the Data Protection Board, grievances or nomination.
• There’s no published privacy contact. Rule 9 needs one.
• HTTPS works, but the HSTS header is missing. A small fix.

None of this is unusual. Most Indian sites run on templates written for the EU’s GDPR, or on no template at all. My plan is to add a consent tool that actually blocks the Google tags until visitors accept, rewrite the privacy notice for DPDP, and publish a contact. I’ll re-scan when it’s done.

How the scanner works

The DPDP Website Checker loads your page the way a first-time visitor’s browser does, before any consent is given, and checks what it can see:

• Which tracking tools load immediately, and whether they’re held back until consent. It recognises about 30 common tools, including Indian marketing platforms like CleverTap, MoEngage and WebEngage, plus Google Consent Mode.
• Whether a known consent tool is present (OneTrust, Cookiebot, CookieYes, Complianz and about 15 others).
• Whether your privacy notice is easy to find, and nine things it should cover under Rule 3, Rule 9 and the Act.
• Forms that collect names, emails, phone numbers, Aadhaar or PAN without a notice nearby.
• HTTPS, the HTTP-to-HTTPS redirect, and HSTS.

You get a score out of 100, a clear “fix this” list with the section or rule behind each item, and a PDF you can hand to your developer.

What it can’t do

It can’t see inside your business. Breach response plans, access logs, vendor contracts, retention schedules and parental consent all happen behind the scenes, so the report lists them as a checklist instead. And it’s not legal advice: a good score means the visible parts look right, not that you’re compliant. Use it to prepare, then confirm with a lawyer.

A quick fix list

1. Add a consent tool that blocks analytics and ad tags until the visitor accepts, with “Reject” as visible as “Accept”.
2. Rewrite your privacy notice for DPDP: itemised data, purposes, withdrawal, rights including nomination, the Data Protection Board, and an Indian language option.
3. Publish a privacy contact (a DPO, or a person who can answer questions).
4. Put a one-line notice and a link next to every form that collects personal data.
5. Turn on HTTPS everywhere and add HSTS.
6. Then work through the internal items: breach plan, one-year logs, vendor contracts, deletion schedules.

The full DPDP website checklist explains all 13 items with the rule each one comes from.

Why I keep building small tools like this

Last week I built a checker for the eMudhra certificate distrust. The pattern is the same: a big change lands, the rules are public, but nobody gives site owners a simple yes-or-no answer for their site. A small, deterministic tool that reads public data can do that in seconds. No AI guessing, just checks you can trace back to a specific rule.

DPDP has a longer runway than most of these, which is exactly why it’s easy to put off. Scan your site today, fix the red items this month, and May 2027 becomes a non-event.

FAQ

Does DPDP apply to a small business website?

Usually yes, if it collects personal data from people in India, including through a contact form or analytics. The Act lets the government exempt some classes of businesses, such as startups, from certain provisions, so check whether any exemption notification covers you.

Do I need a cookie banner under DPDP?

The Act doesn’t mention cookies by name. But tracking tools collect personal data such as device identifiers, and consent must come before collection unless a “legitimate use” under Section 7 applies. In practice, that means holding those tools until visitors agree.

Is the scanner free? Does it store my data?

It’s free, with no sign-up. It doesn’t use cookies or analytics. It keeps scan results to show totals, and your IP address only as a one-way hash for an hour to stop abuse. The privacy notice has the details.

Sources

• Digital Personal Data Protection Rules, 2025 (Gazette, MeitY)
• PIB: DPDP Rules explainer
• Storyboard18: staggered rollout of the DPDP Rules
• Bar & Bench: MeitY notifies final DPDP Rules 2025

This post is for general information and is not legal advice. The scanner is independent and not affiliated with MeitY or the Data Protection Board of India.

Related posts:

The eMudhra emSign Certificate Distrust: What Happened, Who’s Affected, and How to Check Your Site Contact Center and Customer Service Automation: Trends and How to Start Chatbot vs Conversational AI: Key Differences and When to Use Each RPA vs Intelligent Automation: What’s the Difference (and Where AI Agents Fit)